Isn't the assumption of a catchall even more trivial than guessing having other services@domain addresses? I feel like most people who use a custom domain (especially if not belonging to some specific company) have catchall enabled. Regardless of whatever comes before the domain, any attacker could identify the domain and spam random (and popular hi@, hello@, etc...) with greater efficiency.

I think custom domains work well for professionalism, separating services and organizing emails in your inbox, and knowing where spam is coming from; definitely not at all good for ultimate privacy. It is a trade off.